lucasar · HackerTrans

7 miesięcy temudiscuss

Yes, that is used to exchange information between iDevices. The "Find my" mechanism is proprietary and closed source, so you cannot categorically discard the possibility of iOS using such tunnel to send/receive/forward such information. Yes it could be something else. But if we want to be rigorous, we cannot discard possibilities we aren't 100% sure about.

lucasar

7 miesięcy temudiscuss

Well, such traffic goes OUT somewhere and that somewhere is other iDevices so that's traffic coming IN for them, no? I don't have evidence supporting either possibility other than the fact that there's indeed an obscure mesh network involved for "Find My" to operate. I hope this is the starting point to figuring out what their infrastructure does.

lucasar

7 miesięcy temudiscuss

Maybe the culprit is the technology and nasty tricks backing the "Find my device" feature? iOS devices will share their location (and potentially other data) with other nearby devices using a mesh network with certain frequency, even in Airplane mode. Also if the iPhone/iPad is powered off using the "power off" feature, the device will still be findable.

This capability is one of the strong selling points for consumers. The modern, average thief will often toss away these devices and settle with the rest of the loot because of this.

Sounds like OP wasn't aware of this.

lucasar

6 lat temudiscuss

The above is correct. Facebook wants you to use the SDK.

lucasar

6 lat temudiscuss

It is evident that Facebook does not QA the way they should. It would be nice if Apple added mechanisms that allow a dependency in an app to crash but allow the host app to continue to run regardless.

lucasar

6 lat temudiscuss

I think AD is probably the best (if not the single) reason to use MS boxes. It's quite a beast and you have to know its little tricks but hey, the same goes for any other solution of similar scale.

lucasar

6 lat temudiscuss

Former Senior Windows SysAdmin here --worked in large scale infrastructures and was the lead in a team dedicated to securing hundreds/thousands of servers.

My answer: No f*ing way.

I've seen too many times that pattern of "oh we fixed this security flaw on a patch tuesday only to realize it opened a backdoor in some other way". Securing Windows boxes is a pointless rat race. They have backdoors in them, guaranteed.

lucasar

6 lat temudiscuss

That is definitely not the case for the ~10 relevant apps I have worked on.

lucasar

6 lat temudiscuss

You have no idea what you're talking about. Apps use the Facebook library because a good portion of end-users want to be able to login with a Facebook button --or Google, or whatever that doesn't require them to create a user/password account. It's just that simple.

lucasar

6 lat temudiscuss

I am an iOS developer and most likely the problem is related to configuration and basic analytics, not "siphoning" app data.

Offending code :

if (restrictiveParams[eventName][@"is_deprecated_event"]) {

        [deprecatedEventSet addObject:eventName];

}

So, the iOS library does not check for nil, and whatever the server is returning does not have the expected content. Lame.

lucasar

6 lat temudiscuss

You beat me by a couple of minutes. Dear Facebook: Please move slower and break fewer things. Thank you very much.

comments